Critical Apache OFBiz Flaw (CVE-2025-59118) Allows Remote Command Execution via Unrestricted File Upload

The Apache Software Foundation has issued a security update for Apache OFBiz, addressing two disclosed vulnerabilities affecting all versions before 24.09.03. The most severe, CVE-2025-59118, is an Unrestricted Upload of File with Dangerous Type flaw that could allow remote attackers to upload arbitrary files and potentially execute commands on the server under the service’s context.

Attackers exploiting this flaw could gain complete OS control, deploy web shells, or move laterally into enterprise networks where OFBiz is in use. The second issue, CVE-2025-61623, is a reflected XSS vulnerability that could enable attackers to inject malicious JavaScript via manipulated URLs or inputs, allowing theft of session cookies or impersonation within OFBiz’s web management console, according to the advisory. ASF strongly urges upgrades, noting that version 24.09.03 fully mitigates the issues.